keystone public client requests can leak admin endpoint details

[sahilsinha]

Keystone is set up with a publicURL that points to a public IP.

from a remote client accessing the publicURL endpoint:

openstack token issue works as expected

openstack user password set (or any other keystone command) returns:
Failed to contact the endpoint at https://controller:35357/v2.0 for discovery. Fallback to using that endpoint as the base url.
Unable to establish connection to https://controller:35357/v2.0/users/2bc1e7d95977481caba970d201176cc4/password

doing openstack --os-interface public resolves the issue and allows one to update a password via the publicURL endpoint or get the appropriate response from other commands(403)

[Dean Troyer (dtroyer)]

It is possible this is a keystoneclient default leaking though (I haven't looked yet).

[Dean Troyer (dtroyer)]

I'm leaving this private for now, but API-related things like this are generally not a security issue for clients, there is nothing here that can't be done via curl. If it turns out to be in ksc, it may need to stay private as ksc is used in server-side places also.

[Dean Troyer (dtroyer)]

Marking incomplete, the leaking of endpoint information is all possible via curl and is an API design issue not a client issue, if it is an issue at all.